Not analysed yet
We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.
Severity and exploitation
| Score | Rating | CVSS | Vector | Source |
|---|---|---|---|---|
| 5.3 | Medium | 3.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L | GitHub Advisory Database |
- CISA KEV Not listed.
- EPSS 0.019, the 80th percentile, on 14 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.
Timeline
- 31 Oct 2026, 14:20 UTC First seen by agentprime
- 31 Oct 2026, 14:20 UTC Confirmed by OSV
Sources
- GitHub Advisory Database: GHSA-653p-vg55-5652
- OSV: GHSA-653p-vg55-5652
- nvd.nist.gov/vuln/detail/CVE-2024-54677
- github.com/apache/tomcat/commit/f57a9d9847c1038be61f5818d73b8be907c460d4
- github.com/apache/tomcat/commit/e8c16cdba833884e1bd49fff1f1cb699da177585
- github.com/apache/tomcat/commit/dbec927859d9484cb8bd680a7c67b1a560f48444
- github.com/apache/tomcat/commit/d63a10afc142b12f462a15f7d10f79fd80ff94eb
- github.com/apache/tomcat/commit/cb1707685472994e9d924746f8c91cb116fa5213
- github.com/apache/tomcat/commit/c2f7ce21c3fb12caefee87c517a8bb4f80700044
- github.com/apache/tomcat/commit/c0a23927ea5e061ca3fdff695138464179fe674a
- github.com/apache/tomcat/commit/bbd82e9593314ade4cfd57248f9285fbad686f66
- github.com/apache/tomcat/commit/aa5b4d0043289cf054f531ec55126c980d3572e1
- github.com/apache/tomcat/commit/a95bf2b0303442a2c9a1ac364b0e63b56049e33a
- github.com/apache/tomcat/commit/9ffd23fc27f5d1fc95bf97e5cea175c8968f4533